Merge remote-tracking branch 'upstream/develop' into develop

This commit is contained in:
alexjacks92 2014-02-07 11:04:30 -05:00
commit f1c8ca73d6
9 changed files with 83 additions and 111 deletions

View File

@ -1,6 +1,4 @@
OpenIDE-Module-Name=FileExtMismatch
FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.text=Skip Known Files (NSRL)
FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.toolTipText=Depending on how many files have known hashes, checking this box will improve the speed of mismatch detection.
FileExtMismatchConfigPanel.extHeaderLabel.text=Allowed Extensions:
FileExtMismatchConfigPanel.userExtTextField.text=
FileExtMismatchConfigPanel.addExtButton.text=Add Extension
@ -15,5 +13,5 @@ FileExtMismatchConfigPanel.mimeErrLabel.text=\
FileExtMismatchConfigPanel.mimeRemoveErrLabel.text=\
FileExtMismatchConfigPanel.extRemoveErrLabel.text=\
FileExtMismatchConfigPanel.saveMsgLabel.text=\
FileExtMismatchSimpleConfigPanel.skipNoExtCheckBox.text=Skip Files Without Extensions
FileExtMismatchSimpleConfigPanel.skipTextPlain.text=Skip text/plain MIME type
FileExtMismatchSimpleConfigPanel.skipNoExtCheckBox.text=Skip files without extensions
FileExtMismatchSimpleConfigPanel.skipTextPlain.text=Skip text files

View File

@ -50,10 +50,9 @@ import org.sleuthkit.datamodel.TskException;
public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile {
private static FileExtMismatchIngestModule defaultInstance = null;
private static final Logger logger = Logger.getLogger(FileExtMismatchIngestModule.class.getName());
public static final String MODULE_NAME = "File Extension Mismatch Detection";
public static final String MODULE_DESCRIPTION = "Flags mismatched filename extensions based on file signature.";
public static final String MODULE_NAME = "Extension Mismatch Detector";
public static final String MODULE_DESCRIPTION = "Flags files that have a non-standard extension based on their file type.";
public static final String MODULE_VERSION = Version.getVersion();
private static final String ART_NAME = "TSK_MISMATCH";
private static long processTime = 0;
private static int messageId = 0;
@ -62,14 +61,11 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In
private static boolean skipNoExt = true;
private static boolean skipTextPlain = false;
private int attrId = -1;
private int attrId2 = -1;
private FileExtMismatchSimpleConfigPanel simpleConfigPanel;
private FileExtMismatchConfigPanel advancedConfigPanel;
private IngestServices services;
private HashMap<String, String[]> SigTypeToExtMap = new HashMap<>();
private String currActualExt = "";
private String currActualSigType = "";
// Private to ensure Singleton status
private FileExtMismatchIngestModule() {
@ -118,12 +114,12 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In
{
long startTime = System.currentTimeMillis();
boolean flag = compareSigTypeToExt(abstractFile);
boolean mismatchDetected = compareSigTypeToExt(abstractFile);
processTime += (System.currentTimeMillis() - startTime);
numFiles++;
if (flag) {
if (mismatchDetected) {
// add artifact
BlackboardArtifact bart = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED);
@ -136,9 +132,14 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In
}
}
/**
* Compare file type for file and extension.
* @param abstractFile
* @return false if the two match. True if there is a mismatch.
*/
private boolean compareSigTypeToExt(AbstractFile abstractFile) {
try {
currActualExt = abstractFile.getNameExtension();
String currActualExt = abstractFile.getNameExtension();
// If we are skipping names with no extension
if (skipNoExt && currActualExt.isEmpty()) {
@ -146,42 +147,36 @@ public class FileExtMismatchIngestModule extends org.sleuthkit.autopsy.ingest.In
}
// find file_sig value.
// getArtifacts by type doesn't seem to work, so get all artifacts
ArrayList<BlackboardArtifact> artList = abstractFile.getAllArtifacts();
// check the blackboard for a file type attribute
ArrayList<BlackboardAttribute> attributes = abstractFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
for (BlackboardAttribute attribute : attributes) {
String currActualSigType = attribute.getValueString();
if (skipTextPlain) {
if (!currActualExt.isEmpty() && currActualSigType.equals("text/plain")) {
return false;
}
}
for (BlackboardArtifact art : artList) {
List<BlackboardAttribute> atrList = art.getAttributes();
for (BlackboardAttribute att : atrList) {
if (att.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID()) {
currActualSigType = att.getValueString();
if (skipTextPlain)
{
if (!currActualExt.isEmpty()&&currActualSigType.equals("text/plain"))
{
return false;
}
}
//get known allowed values from the map for this type
String[] slist = SigTypeToExtMap.get(att.getValueString());
if (slist != null) {
List<String> allowedExtList = Arrays.asList(slist);
//get known allowed values from the map for this type
String[] allowedExtArray = SigTypeToExtMap.get(currActualSigType);
if (allowedExtArray != null) {
List<String> allowedExtList = Arrays.asList(allowedExtArray);
// see if the filename ext is in the allowed list
if (allowedExtList != null) {
for (String e : allowedExtList) {
if (e.equals(currActualExt)) {
return false;
}
}
return true; //potential mismatch
// see if the filename ext is in the allowed list
if (allowedExtList != null) {
for (String e : allowedExtList) {
if (e.equals(currActualExt)) {
return false;
}
}
return true; //potential mismatch
}
}
}
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
logger.log(Level.WARNING, "Error while getting file signature from blackboard.", ex);
}
return false;
}

View File

@ -21,9 +21,8 @@
<Group type="103" groupAlignment="0" attributes="0">
<Component id="skipTextPlain" min="-2" max="-2" attributes="0"/>
<Component id="skipNoExtCheckBox" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="skipKnownCheckBox" alignment="0" min="-2" pref="165" max="-2" attributes="0"/>
</Group>
<EmptySpace min="0" pref="327" max="32767" attributes="0"/>
<EmptySpace min="0" pref="138" max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
@ -33,28 +32,12 @@
<Component id="skipNoExtCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="skipTextPlain" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="skipKnownCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="72" max="32767" attributes="0"/>
<EmptySpace pref="51" max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>
</Layout>
<SubComponents>
<Component class="javax.swing.JCheckBox" name="skipKnownCheckBox">
<Properties>
<Property name="selected" type="boolean" value="true"/>
<Property name="text" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/fileextmismatch/Bundle.properties" key="FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
<Property name="toolTipText" type="java.lang.String" editor="org.netbeans.modules.i18n.form.FormI18nStringEditor">
<ResourceString bundle="org/sleuthkit/autopsy/fileextmismatch/Bundle.properties" key="FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.toolTipText" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="skipKnownCheckBoxActionPerformed"/>
</Events>
</Component>
<Component class="javax.swing.JCheckBox" name="skipNoExtCheckBox">
<Properties>
<Property name="selected" type="boolean" value="true"/>

View File

@ -30,8 +30,7 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel {
}
private void customizeComponents() {
// Hidden for now
skipKnownCheckBox.setVisible(false);
}
@ -44,19 +43,9 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel {
// <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
private void initComponents() {
skipKnownCheckBox = new javax.swing.JCheckBox();
skipNoExtCheckBox = new javax.swing.JCheckBox();
skipTextPlain = new javax.swing.JCheckBox();
skipKnownCheckBox.setSelected(true);
skipKnownCheckBox.setText(org.openide.util.NbBundle.getMessage(FileExtMismatchSimpleConfigPanel.class, "FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.text")); // NOI18N
skipKnownCheckBox.setToolTipText(org.openide.util.NbBundle.getMessage(FileExtMismatchSimpleConfigPanel.class, "FileExtMismatchSimpleConfigPanel.skipKnownCheckBox.toolTipText")); // NOI18N
skipKnownCheckBox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
skipKnownCheckBoxActionPerformed(evt);
}
});
skipNoExtCheckBox.setSelected(true);
skipNoExtCheckBox.setText(org.openide.util.NbBundle.getMessage(FileExtMismatchSimpleConfigPanel.class, "FileExtMismatchSimpleConfigPanel.skipNoExtCheckBox.text")); // NOI18N
skipNoExtCheckBox.addActionListener(new java.awt.event.ActionListener() {
@ -80,9 +69,8 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel {
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(skipTextPlain)
.addComponent(skipNoExtCheckBox)
.addComponent(skipKnownCheckBox, javax.swing.GroupLayout.PREFERRED_SIZE, 165, javax.swing.GroupLayout.PREFERRED_SIZE))
.addGap(0, 327, Short.MAX_VALUE))
.addComponent(skipNoExtCheckBox))
.addGap(0, 138, Short.MAX_VALUE))
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
@ -90,16 +78,10 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel {
.addComponent(skipNoExtCheckBox)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(skipTextPlain)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(skipKnownCheckBox)
.addContainerGap(72, Short.MAX_VALUE))
.addContainerGap(51, Short.MAX_VALUE))
);
}// </editor-fold>//GEN-END:initComponents
private void skipKnownCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_skipKnownCheckBoxActionPerformed
FileExtMismatchIngestModule.setSkipKnown(skipKnownCheckBox.isSelected());
}//GEN-LAST:event_skipKnownCheckBoxActionPerformed
private void skipNoExtCheckBoxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_skipNoExtCheckBoxActionPerformed
FileExtMismatchIngestModule.setSkipNoExt(skipNoExtCheckBox.isSelected());
}//GEN-LAST:event_skipNoExtCheckBoxActionPerformed
@ -110,7 +92,6 @@ class FileExtMismatchSimpleConfigPanel extends javax.swing.JPanel {
}//GEN-LAST:event_skipTextPlainActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JCheckBox skipKnownCheckBox;
private javax.swing.JCheckBox skipNoExtCheckBox;
private javax.swing.JCheckBox skipTextPlain;
// End of variables declaration//GEN-END:variables

View File

@ -28,7 +28,7 @@
<Group type="102" alignment="0" attributes="0">
<EmptySpace min="-2" pref="11" max="-2" attributes="0"/>
<Component id="skipKnownCheckBox" min="-2" max="-2" attributes="0"/>
<EmptySpace pref="175" max="32767" attributes="0"/>
<EmptySpace pref="45" max="32767" attributes="0"/>
</Group>
</Group>
</DimensionLayout>

View File

@ -67,7 +67,7 @@ package org.sleuthkit.autopsy.filetypeid;
.addGroup(layout.createSequentialGroup()
.addGap(11, 11, 11)
.addComponent(skipKnownCheckBox)
.addContainerGap(175, Short.MAX_VALUE))
.addContainerGap(45, Short.MAX_VALUE))
);
}// </editor-fold>//GEN-END:initComponents

View File

@ -57,8 +57,8 @@ ModalNoButtons.CURRENTLYON_LABEL.text=Currently Indexing x of y
ModalNoButtons.GO_GET_COFFEE_LABEL.text=Hash databases are currently being indexed, this may take some time.
ModalNoButtons.cancelButton.text=Cancel
ModalNoButtons.CANCEL_BUTTON.text=Cancel
HashDbSimpleConfigPanel.knownBadHashDbsLabel.text=Enable known bad databases for ingest:
HashDbSimpleConfigPanel.knownHashDbsLabel.text=Enable known hash databases for ingest:
HashDbSimpleConfigPanel.knownBadHashDbsLabel.text=Select known BAD hash databases to use:
HashDbSimpleConfigPanel.knownHashDbsLabel.text=Select known hash databases to use:
HashDbImportDatabaseDialog.knownRadioButton.text=Known (NSRL or other)
HashDbCreateDatabaseDialog.knownRadioButton.text=Known
HashDbCreateDatabaseDialog.jLabel1.text=Database Path:
@ -73,7 +73,7 @@ HashDbImportDatabaseDialog.sendIngestMessagesCheckbox.text=Send ingest messages
HashDbImportDatabaseDialog.hashSetNameTextField.text=
HashDbConfigPanel.createDatabaseButton.text=Create Database
HashDbImportDatabaseDialog.openButton.text=Open...
HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text=Calculate hashes even if no hash database is selected
HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text=Calculate MD5 even if no hash database is selected
HashDbCreateDatabaseDialog.jLabel3.text=Hash Set Name:
HashDbCreateDatabaseDialog.okButton.text=OK
HashDbCreateDatabaseDialog.databasePathTextField.text=

View File

@ -19,16 +19,19 @@
<Group type="102" attributes="0">
<EmptySpace max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="jScrollPane1" pref="0" max="32767" attributes="1"/>
<Component id="alwaysCalcHashesCheckbox" alignment="1" pref="285" max="32767" attributes="0"/>
<Group type="102" attributes="0">
<EmptySpace min="10" pref="10" max="-2" attributes="0"/>
<Group type="103" groupAlignment="0" attributes="0">
<Component id="knownHashDbsLabel" min="-2" max="-2" attributes="0"/>
<Component id="knownBadHashDbsLabel" alignment="0" min="-2" max="-2" attributes="0"/>
<Component id="jScrollPane2" pref="0" max="32767" attributes="1"/>
<Component id="jScrollPane1" pref="0" max="32767" attributes="1"/>
</Group>
</Group>
<Group type="102" attributes="0">
<Component id="knownHashDbsLabel" min="-2" pref="272" max="-2" attributes="0"/>
<EmptySpace min="0" pref="0" max="32767" attributes="0"/>
</Group>
<Component id="jScrollPane2" alignment="1" pref="0" max="32767" attributes="1"/>
<Component id="alwaysCalcHashesCheckbox" alignment="1" max="32767" attributes="0"/>
<Component id="knownBadHashDbsLabel" max="32767" attributes="0"/>
</Group>
<EmptySpace max="-2" attributes="0"/>
</Group>
@ -37,15 +40,14 @@
<DimensionLayout dim="1">
<Group type="103" groupAlignment="0" attributes="0">
<Group type="102" alignment="0" attributes="0">
<EmptySpace max="32767" attributes="0"/>
<Component id="knownHashDbsLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="jScrollPane1" min="-2" pref="55" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="-2" attributes="0"/>
<Component id="jScrollPane1" min="-2" pref="58" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="knownBadHashDbsLabel" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
<Component id="jScrollPane2" min="-2" pref="55" max="-2" attributes="0"/>
<EmptySpace type="unrelated" max="32767" attributes="0"/>
<Component id="jScrollPane2" min="-2" pref="85" max="-2" attributes="0"/>
<EmptySpace max="32767" attributes="0"/>
<Component id="alwaysCalcHashesCheckbox" min="-2" max="-2" attributes="0"/>
<EmptySpace max="-2" attributes="0"/>
</Group>
@ -98,6 +100,9 @@
<ResourceString bundle="org/sleuthkit/autopsy/hashdatabase/Bundle.properties" key="HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text" replaceFormat="org.openide.util.NbBundle.getMessage({sourceFileName}.class, &quot;{key}&quot;)"/>
</Property>
</Properties>
<Events>
<EventHandler event="actionPerformed" listener="java.awt.event.ActionListener" parameters="java.awt.event.ActionEvent" handler="alwaysCalcHashesCheckboxActionPerformed"/>
</Events>
</Component>
<Container class="javax.swing.JScrollPane" name="jScrollPane2">
<Properties>

View File

@ -195,6 +195,11 @@ public class HashDbSimpleConfigPanel extends javax.swing.JPanel {
knownHashDbsLabel.setText(org.openide.util.NbBundle.getMessage(HashDbSimpleConfigPanel.class, "HashDbSimpleConfigPanel.knownHashDbsLabel.text")); // NOI18N
alwaysCalcHashesCheckbox.setText(org.openide.util.NbBundle.getMessage(HashDbSimpleConfigPanel.class, "HashDbSimpleConfigPanel.alwaysCalcHashesCheckbox.text")); // NOI18N
alwaysCalcHashesCheckbox.addActionListener(new java.awt.event.ActionListener() {
public void actionPerformed(java.awt.event.ActionEvent evt) {
alwaysCalcHashesCheckboxActionPerformed(evt);
}
});
jScrollPane2.setBorder(javax.swing.BorderFactory.createEtchedBorder());
@ -218,33 +223,38 @@ public class HashDbSimpleConfigPanel extends javax.swing.JPanel {
.addGroup(layout.createSequentialGroup()
.addContainerGap()
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE)
.addComponent(alwaysCalcHashesCheckbox, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.DEFAULT_SIZE, 285, Short.MAX_VALUE)
.addGroup(layout.createSequentialGroup()
.addGap(10, 10, 10)
.addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addComponent(knownHashDbsLabel)
.addComponent(knownBadHashDbsLabel))
.addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE)
.addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE)))
.addGroup(layout.createSequentialGroup()
.addComponent(knownHashDbsLabel, javax.swing.GroupLayout.PREFERRED_SIZE, 272, javax.swing.GroupLayout.PREFERRED_SIZE)
.addGap(0, 0, Short.MAX_VALUE))
.addComponent(jScrollPane2, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.PREFERRED_SIZE, 0, Short.MAX_VALUE)
.addComponent(alwaysCalcHashesCheckbox, javax.swing.GroupLayout.Alignment.TRAILING, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addComponent(knownBadHashDbsLabel, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
.addContainerGap())
);
layout.setVerticalGroup(
layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
.addGroup(layout.createSequentialGroup()
.addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(knownHashDbsLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 55, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED)
.addComponent(jScrollPane1, javax.swing.GroupLayout.PREFERRED_SIZE, 58, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(knownBadHashDbsLabel)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED)
.addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 55, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.UNRELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(jScrollPane2, javax.swing.GroupLayout.PREFERRED_SIZE, 85, javax.swing.GroupLayout.PREFERRED_SIZE)
.addPreferredGap(javax.swing.LayoutStyle.ComponentPlacement.RELATED, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
.addComponent(alwaysCalcHashesCheckbox)
.addContainerGap())
);
}// </editor-fold>//GEN-END:initComponents
private void alwaysCalcHashesCheckboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_alwaysCalcHashesCheckboxActionPerformed
// TODO add your handling code here:
}//GEN-LAST:event_alwaysCalcHashesCheckboxActionPerformed
// Variables declaration - do not modify//GEN-BEGIN:variables
private javax.swing.JCheckBox alwaysCalcHashesCheckbox;
private javax.swing.JScrollPane jScrollPane1;